Responsibility cannot be delegated: AI in risk without losing expert judgment

What it is about

Juan Daniel Pujols Pérez, Director of Technology and Information Security Supervision at the Superintendency of Banks of the Dominican Republic, presented at the Fourth Annual Risk Conference (September 17, 2026) a practical framework for adopting artificial intelligence in risk and control without losing expert judgment. He made clear at the start that everything said was his personal opinion and not the official position of the Superintendency.

The 29 slides start from a context of fast adoption (more than a billion people use ChatGPT every week and 78% of organizations already use AI in some function) and from a real case: EY withdrew a public report because 16 of its 27 references did not exist, and all four big firms withdrew or corrected reports for the same pattern. The conclusion is that no control failed, because there was none. Hence the principle that an AI strategy is defined first in governance and then in technology, and that an agent is not a simple automation: it pursues an objective, decides the plan and acts.

The second part brings the framework down to practice. It proposes an own regulatory corpus, curated by people and queried by an open-weights model in-house, where without a citation there is no finding; a matrix that decides which data may touch which model; four non-negotiable rules; the five-dimension VIGÍA framework; three levels of supervised autonomy; and a demonstration with a personal prototype and fictitious data. It closes with one sentence: delegate the task, not the responsibility.

Objectives

• Show why AI in risk and control demands more expert judgment, not less, with a real case of reports withdrawn for non-existent references.
• Present a governance framework to decide which data may touch which model, with four rules and the five dimensions of the VIGÍA framework.
• Explain with a demonstration how an agent cross-checks regulation against a file and proposes findings that a person reviews and signs.

Key takeaways

1. 78% of organizations already use AI in at least one business function, and global financial compliance costs about US$206 billion a year.
2. In the EY Canada case (December 2025), an external review found that 16 of the 27 references did not exist and estimated 72% of the text as AI-generated; Deloitte, EY, KPMG and PwC withdrew or corrected reports for the same pattern.
3. The decision matrix allows the frontier model in the cloud only with public or non-sensitive internal data; with sensitive data an open-weights model runs on the own infrastructure, and critical decisions are closed by a person.
4. The four rules are govern, evaluate, test, document and repeat; the signer must be a human being; that human must know the trade; and sensitive data runs at home.
5. The VIGÍA framework covers Validation, Integrity, Governance, Interpretation and Supervised autonomy, with three levels: human in the loop, human on the loop and autonomous; level 3 should not decide on clients or third parties.